Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.1
CVE-2018-18600: Guardzilla GZ180 firmware update can run attacker commands
CVE-2018-18600 · published 7 years ago
Summary
The remote upgrade function in Guardzilla GZ180 indoor and outdoor devices can be tricked into executing malicious commands when a specially crafted firmware version is supplied. This could let an attacker take control of the device or disrupt its operation. Apply the vendor's security update or disable remote upgrades until the patch is installed.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| guardzilla | 180_outdoor_firmware |
All versions
cpe:2.3:o:guardzilla:180_outdoor_firmware:-:*:*:*:*:*:*:* |
| guardzilla | 180_indoor_firmware |
All versions
cpe:2.3:o:guardzilla:180_indoor_firmware:-:*:*:*:*:*:*:* |
Original advisory text
The remote upgrade feature in Guardzilla GZ180 devices allow command injection via a crafted new firmware version parameter.
The remote upgrade feature in Guardzilla GZ180 devices allow command injection via a crafted new firmware version parameter.
References
- https://labs.bitdefender.com/2018/12/iot-report-major-flaws-in-guardzilla-camera... Third Party Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-78OS Command Injection
Timeline
Published31 Dec 2018
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2018-18600 · NVD
Track software like this
Free during beta